Exam CISM topic 1 question 214 discussion

Right to Audit.

In the "CISM Review Manual 15th Edition" by ISACA, it is stated in Domain 4: Incident Management and Response, that continuous monitoring is a critical part of the overall incident management process, and it extends to monitoring third-party providers to ensure they meet the organization's security requirements.

In the "CISM Review Manual 15th Edition" by ISACA, it is stated in Domain 4: Incident Management and Response, that continuous monitoring is a critical part of the overall incident management process, and it extends to monitoring third-party providers to ensure they meet the organization's security requirements.

Continuous versus periodic verification --> Continuous will always be better

C. Right-to-audit clause in the contract

Right-to-audit clause can include continuous monitoring. Audit =/= periodic (people get stuck with this). It's like you enable auditing of specific action or a file system in the OS. It's not periodic, it's constant (and you can call it continuous monitoring).

To be frank A is the best answer. Continuous versus periodic verification --> Continuous will always be better A is better than C. Answer is --> A

If someone read this. When do we use "Right to Audit"?

I understand that audit and assurance go hand in hand. However, if we have to pick between audit and continuous monitoring, I'd pick monitoring. Audit will provide the snapshot of the state of security at a specific time, which can change post audit. Continuous monitoring will be required for ongoing assurance. Answer: A

C. Right-to-audit clause in the contract

C may be wrong because the audit will not happen not so frequently, hence making sure assurance all time is not possible

i vote .....C. Right-to-audit clause in the contract

A for sure, it's the only method to assure while audit can not since vendor can alter controls after the audit is closed. Besides, continuous monitoring generally performs after an audit or security assessment, why it is called "continuous monitoring" but not just "monitoring"

Auditoría siempre como principio de SLA

Continuous monitoring helps in ongoing oversight, but it may not cover all aspects of security requirements. Due diligence questionnaires provide initial information, but they may not be sufficient to validate the provider's security practices comprehensively. Performance metrics can indicate the provider's performance but may not directly address security requirements.

All these questions are so ambiguous. So much room for assumptions and interpretation. Continuous monitoring can give assurance but the best assurance is an audit. But a right to audit clause means nothing unless an audit is conducted in which case continuous monitoring gives better assurance than right to audit clause.

The right-to-audit clause in the contract provides the BEST assurance that a contracted third-party provider meets an organization's security requirements. This clause grants the organization the right to perform audits or inspections of the third-party's facilities, personnel, systems, or documentation. By exercising this right, the organization can confirm that the third-party is complying with security requirements and can identify any security gaps or deficiencies. Continuous monitoring, due diligence questionnaires, and performance metrics are all useful measures, but they cannot provide the same level of assurance as a direct audit.